Another point is that it still works if you're inside a chroot / jail / container / with no devices visible.

In a way, that's the point of chroot/jail/container: isolate the host filesystem from the guest, so the script that creates it should take /dev into account if it is needed

The point is to isolate access to the host, and single secure random numbers have nothing to do with the host.